An ISO 9001 audit checklist is a structured set of questions and evidence prompts used by auditors to assess whether an organization's Quality Management System (QMS) is effectively implemented and conforms to applicable ISO 9001 requirements.

A good audit checklist should do more than ask whether a procedure exists.

It should help the auditor determine:

• Whether the required processes have been established and implemented
• Whether employees understand and follow those processes
• Whether objective evidence demonstrates that processes are working
• Whether quality objectives are being monitored and achieved
• Whether risks and opportunities are being addressed
• Whether nonconformities are investigated and corrected
• Whether corrective actions are effective
• Whether the QMS is continually improved

This checklist is designed as a practical starting point for internal auditors. It should be adapted to the organization's scope, processes, products, services, risks, and applicable requirements.

ISO 9001 requirements are organized around the organization's context, leadership, planning, support, operation, performance evaluation, and improvement.

Use the following checklist to guide an internal audit.

Audit questions

• Has the organization identified internal and external issues that can affect the intended results of the QMS?
• Are relevant business, technological, market, regulatory, and organizational changes monitored?
• Are significant changes in the organization's context reviewed periodically?
• Can management explain which issues are most important to the effectiveness of the QMS?

Objective evidence to consider

• Context analysis
• SWOT or equivalent analysis
• Business planning records
• Risk and opportunity records
• Management review records
• Strategic planning documents
• Records demonstrating review of significant changes

Audit questions

• Has the organization identified relevant interested parties?
• Have relevant requirements of customers, regulators, employees, suppliers and other interested parties been identified?
• Are changes in relevant requirements monitored?
• Are these requirements considered when operating and improving the QMS?

Objective evidence to consider

• Interested-party register
• Customer requirements
• Regulatory requirements
• Contracts
• Supplier requirements
• Applicable statutory requirements
• Management review records

Audit questions

• Is the scope of the QMS clearly defined?
• Does the scope identify the organization's relevant products, services, locations and activities?
• Is the scope consistent with the organization's context and processes?
• Are any requirements determined to be not applicable appropriately justified?

Objective evidence to consider

• Approved QMS scope
• Quality manual or equivalent information
• Process maps
• Organization structure
• Site and facility information

Audit questions

• Have the processes required for the QMS been identified?
• Are process inputs, outputs, responsibilities and interactions understood?
• Are criteria and methods established to ensure effective process operation?
• Are process risks and opportunities addressed?
• Are process performance and effectiveness monitored?
• Are processes improved when necessary?

Objective evidence to consider

• Process maps
• Process owners
• SOPs and work instructions
• KPIs
• Process performance records
• Risk assessments
• Audit findings
• Improvement actions

Audit questions

• Does top management demonstrate accountability for the effectiveness of the QMS?
• Is the QMS integrated into the organization's business processes?
• Is customer focus demonstrated?
• Are adequate resources provided for the QMS?
• Does management promote process-based thinking and continual improvement?
• Does management support people who contribute to QMS effectiveness?

Objective evidence to consider

• Management review records
• Business objectives
• Resource planning
• Quality objectives
• Meeting records
• Improvement initiatives
• Management communications

Audit questions

• Has a quality policy been established?
• Is the policy appropriate to the organization's purpose and context?
• Does it provide a framework for establishing quality objectives?
• Does it demonstrate commitment to applicable requirements and continual improvement?
• Is the policy communicated and understood within the organization?
• Is the policy available to relevant interested parties where appropriate?

Objective evidence to consider

• Approved quality policy
• Employee communication records
• Training or awareness records
• Internal communications
• Posted or electronically controlled policy

Audit questions

• Are QMS responsibilities clearly defined?
• Are authorities communicated to relevant personnel?
• Is responsibility for ensuring QMS conformity assigned?
• Is responsibility for reporting QMS performance assigned?
• Do employees understand their quality-related responsibilities?

Objective evidence to consider

• Organization chart
• Job descriptions
• Responsibility matrix
• Delegation records
• Employee interviews

Audit questions

• Have relevant QMS risks and opportunities been identified?
• Are risks evaluated using defined criteria?
• Are actions planned for significant risks and opportunities?
• Are risk-control actions integrated into QMS processes?
• Is the effectiveness of actions evaluated?
• Are risks reviewed when processes, products or circumstances change?

Objective evidence to consider

• Risk register
• Process risk assessments
• FMEA or equivalent tools
• Action plans
• Risk review records
• CAPA records
• Change control records

Audit questions

• Have quality objectives been established for relevant functions and levels?
• Are objectives measurable where appropriate?
• Are objectives monitored and reviewed?
• Are responsibilities and resources defined?
• Are target dates established?
• Are results evaluated and acted upon?

Objective evidence to consider

• Quality objectives
• KPI dashboards
• Department objectives
• Performance reports
• Management review records
• Improvement plans

Audit questions

• Are significant QMS changes planned before implementation?
• Are the purpose and potential consequences of changes evaluated?
• Are QMS integrity and process interactions considered?
• Are responsibilities and resources defined?
• Are affected documents, processes and personnel identified?

Objective evidence to consider

• Change control records
• Change requests
• Impact assessments
• Approval records
• Updated procedures
• Training records

Audit questions

• Are sufficient resources available to operate the QMS effectively?
• Is required infrastructure available and maintained?
• Are appropriate work environments provided?
• Are monitoring and measuring resources suitable and maintained?
• Where applicable, are organizational knowledge and knowledge needed to operate processes maintained and made available?

Objective evidence to consider

• Resource plans
• Equipment records
• Maintenance records
• Calibration records
• Infrastructure records
• Knowledge repositories
• Competency records

Audit questions

• Are competency requirements defined for personnel performing QMS-related work?
• Are personnel competent based on education, training or experience?
• Are competency gaps identified?
• Is training provided where necessary?
• Is the effectiveness of actions taken to achieve competence evaluated?

Objective evidence to consider

• Job descriptions
• Competency matrices
• Training records
• Qualification records
• Training effectiveness evaluations
• Employee assessments

Audit questions

• Are employees aware of the quality policy?
• Do employees understand relevant quality objectives?
• Do employees understand how their work contributes to QMS effectiveness?
• Are employees aware of the consequences of failing to follow QMS requirements?

Objective evidence to consider

• Awareness training
• Employee interviews
• Induction records
• Communication materials
• Training assessments

Audit questions

• Has the organization determined what needs to be communicated?
• Is it clear who communicates quality-related information?
• Are internal communication methods effective?
• Are relevant external communications controlled?

Objective evidence to consider

• Communication procedures
• Meeting records
• Quality alerts
• Customer communications
• Supplier communications
• Internal announcements

Audit questions

• Is required documented information available and suitable for use?
• Are documents appropriately identified and described?
• Are documents reviewed and approved before use?
• Is document revision status controlled?
• Are current versions available at points of use?
• Are obsolete documents prevented from unintended use?
• Are externally originated documents controlled where necessary?
• Are records adequately protected, retained and retrievable?

Objective evidence to consider

• Document register
• Controlled SOPs
• Revision history
• Approval records
• Distribution records
• Document access controls
• Retention schedules
• Archived records
• Audit trails

Common audit risks

Look particularly for:

• Uncontrolled copies
• Outdated SOPs
• Missing approvals
• Documents being used before approval
• Inconsistent versions across departments
• Missing training records for revised documents
• Inadequate retention controls

Audit questions

• Are operational processes planned and controlled?
• Are process criteria established?
• Are required resources available?
• Are required records retained?
• Are planned changes controlled?
• Are unintended changes reviewed and addressed?

Objective evidence to consider

• SOPs
• Work instructions
• Production records
• Service records
• Process controls
• Quality plans
• Inspection records

Audit questions

• Are customer requirements identified?
• Are applicable statutory and regulatory requirements determined?
• Are requirements reviewed before accepting an order or commitment?
• Are changes to customer requirements communicated?
• Are customer communications controlled?

Objective evidence to consider

• Contracts
• Purchase orders
• Customer specifications
• Order review records
• Customer communications
• Change requests

Audit questions

• Is design and development planning controlled?
• Are design inputs identified and reviewed?
• Are design outputs suitable for subsequent processes?
• Are design reviews conducted as planned?
• Are verification and validation activities performed where required?
• Are design changes identified, reviewed and controlled?

Objective evidence to consider

• Design plans
• Specifications
• Design reviews
• Verification records
• Validation records
• Engineering changes
• Approval records

Audit questions

• Are external providers evaluated and selected using defined criteria?
• Are supplier performance and re-evaluation controlled?
• Are purchasing requirements clearly defined?
• Are supplier quality requirements communicated?
• Are incoming products or services verified as appropriate?
• Are supplier nonconformities identified and addressed?

Objective evidence to consider

• Approved supplier list
• Supplier evaluation
• Supplier scorecards
• Purchase specifications
• Incoming inspection
• Supplier audits
• Supplier NCRs
• Supplier corrective actions

Audit questions

• Are production and service activities carried out under controlled conditions?
• Are appropriate documented information and work instructions available?
• Is required monitoring and measurement performed?
• Is identification and traceability maintained where applicable?
• Are customer or external-provider property controls established?
• Are outputs preserved throughout operations?
• Are post-delivery activities controlled where applicable?

Objective evidence to consider

• Work instructions
• Batch records
• Production records
• Inspection records
• Traceability records
• Equipment records
• Preservation records

Audit questions

• Are required verification and inspection activities completed before release?
• Are acceptance criteria satisfied?
• Is release authorization documented?
• Can the organization identify who authorized release?

Objective evidence to consider

• Inspection reports
• Test reports
• Release records
• Certificates
• Approval records
• Batch release documentation

Audit questions

• Are nonconforming outputs identified and controlled?
• Are appropriate actions taken to prevent unintended use or delivery?
• Are decisions regarding disposition documented?
• Is rework or correction verified where appropriate?
• Are concessions or approvals documented?
• Are records of nonconformities retained?

Objective evidence to consider

• NCR records
• Deviation records
• Inspection reports
• Rework records
• Disposition approvals
• Customer concessions
• Corrective action records

Audit questions

• What QMS processes are monitored and measured?
• Are appropriate performance indicators established?
• Is customer satisfaction monitored?
• Are quality trends analyzed?
• Are results communicated to relevant personnel?
• Are actions taken when performance does not meet expectations?

Objective evidence to consider

• KPI dashboards
• Quality metrics
• Customer satisfaction data
• Complaint trends
• NCR trends
• CAPA trends
• Process performance reports

Audit questions

• Is an internal audit program planned?
• Are audit frequency and scope determined based on process importance, changes and previous audit results?
• Are auditors selected to maintain objectivity and impartiality?
• Are audit criteria and scope defined?
• Are audit findings communicated to relevant management?
• Are corrective actions followed up?
• Are audit records retained?

Objective evidence to consider

• Annual audit program
• Audit schedules
• Audit plans
• Auditor competency records
• Audit checklists
• Audit reports
• Findings
• Corrective action records
• Audit closure records

Questions for the auditor

For each audit, consider asking:

• (1) What process or requirement is being audited?
• (2) What criteria are being used?
• (3) What objective evidence was reviewed?
• (4) What was found?
• (5) Is the finding conforming, nonconforming or an observation/improvement opportunity?
• (6) What action is required?
• (7) Who owns the action?
• (8) What is the target date?
• (9) How will effectiveness be verified?

Audit questions

• Is management review conducted at planned intervals?
• Are required QMS performance inputs reviewed?
• Are audit results considered?
• Are customer feedback and complaints considered?
• Are process and product performance results reviewed?
• Are nonconformities and corrective actions reviewed?
• Are changes affecting the QMS considered?
• Are opportunities for improvement identified?
• Are management review decisions and actions recorded?

Objective evidence to consider

• Management review agenda
• Management review minutes
• KPI reports
• Audit results
• Customer feedback
• CAPA/NCR reports
• Risk reports
• Improvement actions
• Action tracking records

Audit questions

• Does the organization identify opportunities for improvement?
• Are improvement opportunities evaluated and prioritized?
• Are improvement actions integrated into QMS processes?
• Is the effectiveness of improvement activities evaluated?

Objective evidence to consider

• Improvement projects
• Process improvement records
• KPI trends
• Employee suggestions
• Management review actions
• Quality improvement initiatives

Audit questions

• Are nonconformities identified and controlled?
• Is immediate correction or containment performed where necessary?
• Are the causes of nonconformities investigated?
• Is root cause analysis appropriate to the problem?
• Are similar or recurring problems considered?
• Are corrective actions implemented?
• Are corrective actions reviewed for effectiveness?
• Are QMS risks and opportunities updated when necessary?
• Are records of nonconformities and corrective actions maintained?

Objective evidence to consider

• NCRs
• CAPAs
• 5 Whys
• Root cause analysis
• Containment actions
• Corrective action plans
• Action owners
• Target dates
• Effectiveness reviews
• Closure approvals

A useful CAPA audit trail

A strong corrective-action record should allow an auditor to follow the complete chain:

Problem → Containment → Investigation → Root Cause → Corrective Action → Implementation → Effectiveness Check → Closure

Audit questions

• Does the organization continually improve the suitability, adequacy and effectiveness of its QMS?
• Are quality trends used to identify improvement opportunities?
• Are recurring problems analyzed?
• Are audit results used to improve processes?
• Are customer feedback and complaints used to identify improvements?
• Does management evaluate whether improvement initiatives are achieving their intended results?

Objective evidence to consider

• Improvement plans
• KPI trends
• Recurring NCR analysis
• CAPA effectiveness
• Customer feedback
• Audit trends
• Management review decisions

An audit should not stop when a checklist question has been answered.

When an auditor identifies an issue, the finding should be documented with enough information for the organization to understand and address it.

Depending on the organization's audit methodology, findings may be classified as:

• Conforming
• Nonconforming / Nonconformity
• Observation
• Opportunity for Improvement
• Not Applicable, where justified

A useful finding record can include:

For significant or recurring findings, the audit process may need to connect to the organization's nonconformance and CAPA processes.

A practical workflow is:

Audit → Finding → NCR → Investigation → Root Cause Analysis → Corrective Action → Effectiveness Analysis → Closure

This creates traceability between the original audit requirement and the corrective action taken.

It also helps Quality teams answer an important audit question:

"Show me what happened to this finding after it was identified."

Before beginning the audit, the audit team should consider:

A common mistake during internal audits is checking only whether a procedure exists.

An effective audit should examine both documented information and actual implementation.

For example:

The objective is to determine whether the QMS is implemented and effective, not merely documented.

A checklist is useful for preparing and conducting an audit. The larger challenge is managing everything that happens before, during and after the audit.

LuitBiz QMS brings these quality processes together in one system.

The result is a connected quality workflow rather than a collection of separate spreadsheets, documents and email threads.

Use this page as a starting point for your internal audit planning and customize the checklist to your organization's QMS, processes, risks, products and applicable requirements.

Download the free ISO 9001 Audit Checklist and use it to prepare your next internal audit by submitting the following form.

Important: This checklist is provided for general informational and audit-preparation purposes. It is not a substitute for the ISO 9001 standard, professional auditing guidance or advice from your certification body. Organizations should use the current applicable edition of ISO 9001 and determine how its requirements apply to their QMS.